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The BSD License Problem 


by Richard Stallman 


See “How to choose a license for your own work” for general recommendations about choosing a license for 
your work. 


The two major categories of free software license are copyleft and non-copyleft. Copyleft licenses such as the 
GNU GPL insist that modified versions of the program must be free software as well. Non-copyleft licenses do 
not insist on this. We recommend copyleft, because it protects freedom for all users, but non-copylefted 
software can still be free software, and useful to the free software community. 


There are many variants of simple non-copyleft free software licenses, such as the Expat license, FreeBSD 
license, X10 license, the X11 license, and the two BSD (Berkeley Software Distribution) licenses. Most of them 
are equivalent except for details of wording, but the license used for BSD until 1999 had a special problem: the 
“obnoxious BSD advertising clause”. It said that every advertisement mentioning the software must include a 
particular sentence: 


3. All advertising materials mentioning features or use of this software 
i must display the following acknowledgement: 
This product includes software developed by the University of 
California, Berkeley and its contributors. 


Initially the obnoxious BSD advertising clause was used only in the Berkeley Software Distribution. That did not 
cause any particular problem, because including one sentence in an ad is not a great practical difficulty. 


If other developers who used BSD-like licenses had copied the BSD advertising clause verbatim—including the 
sentence that refers to the University of California—then they would not have made the problem any bigger. 


But, as you might expect, other developers did not copy the clause verbatim. They changed it, replacing 
“University of California” with their own institution or their own names. The result is a plethora of licenses, 
requiring a plethora of different sentences. 


When people put many such programs together in an operating system, the result is a serious problem. Imagine 
if a software system required 75 different sentences, each one naming a different author or group of authors. To 
advertise that, you would need a full-page ad. 


This might seem like extrapolation ad absurdum, but it is actual fact. In a 1997 version of NetBSD, I counted 75 
of these sentences. (Fortunately NetBSD has decided to stop adding them, and to remove those it could.) 


To address this problem, in my “spare time” I talk with developers who have used BSD-style licenses, asking 
them if they would please remove the advertising clause. Around 1996 I spoke with the developers of FreeBSD 
about this, and they decided to remove the advertising clause from all of their own code. In May 1998 the 
developers of Flick, at the University of Utah, removed this clause. 


Dean Hal Varian at the University of California took up the cause, and championed it with the administration. 
In June 1999, after two years of discussions, the University of California removed this clause from the license of 
BSD. 


Thus, there is now a new BSD license which does not contain the advertising clause. Unfortunately, this does 
not eliminate the legacy of the advertising clause: similar clauses are still present in the licenses of many 
packages which are not part of BSD. The change in license for BSD has no effect on the other packages which 
imitated the old BSD license; only the developers who made them can change them. 


But if they followed Berkeley's lead before, maybe Berkeley's change in policy will convince some of them to 
change. It's worth asking. 
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So if you have a favorite package which still uses the BSD license with the advertising clause, please ask the 
maintainer to look at this web page, and consider making the change. 


And if you want to release a program as non-copylefted free software, please don't use the advertising clause. 
Thus, instead of copying the BSD license from some released package—which might still have the old version of 
the license in it—please use one of the other permissive licenses, such as Expat or FreeBSD. 


You can also help spread awareness of the issue by not using the term “BSD-style”, and not saying “the BSD 
license” which implies there is only one. You see, when people refer to all non-copyleft free software licenses as 
“BSD-style licenses”, some new free software developer who wants to use a non-copyleft free software license 
might take for granted that the place to get it is from BSD. He or she might copy the license with the advertising 
clause, not by specific intention, just by chance. 


If you would like to cite one specific example of a non-copyleft license, and you have no particular preference, 
please pick an example which has no particular problem. For instance, if you talk about “X11-style licenses”, you 
will encourage people to copy the license from X11, which avoids the advertising clause for certain, rather than 
take a risk by randomly choosing one of the BSD licenses. 


Or you could mention the non-copyleft license which we recommend over the other non-copyleft licenses: the 
Apache 2.0 license, which has a clause to prevent treachery with patents. 


When you want to refer specifically to one of the BSD licenses, please always state which one: the “original BSD 
license” or the “Modified BSD license”. 


Later a third BSD license variant was introduced, with only the first two of the original BSD license's four 
clauses. We call it the “FreeBSD license.” It is a lax, noncopyleft free license, compatible with the GNU GPL, 
much like the modified BSD license. 

Copyright © 1998, 1999, 2001, 2003, 2007, 2013-2015, 2020, 2021 Free Software Foundation, Inc. 


This page is licensed under a Creative Commons Attribution-NoDerivatives 4.0 International License. 
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Comparison BSD vs. Linux: the whole truth 


Isaac | | Conferences / Events / Talks, Free software 
Comentarios 





There are many comparative of this type on the Internet, but the vast majority are made by 
staunch defenders of BSD. This makes them unreliable and impartial, so | have decided to 
make this personal comparison. As a user of Linux and FreeBSD distributions | can be quite 
clear when it comes to analyzing both systems, both their advantages and disadvantages. 
Beforehand | want to clarify that both are very good systems and, most importantly, free. 
With this | do not want to leave BSD bad for its own sake, but to explain why Linux has 
emerged victorious and is more widespread. 


What flavor do you prefer? Linux has hundreds of distributions that are adapted to the 
needs of end users or to different unions. Instead BSD has variants that focus on something 
specific, such as performance (FreeBSD), potability (NetBSD), security (OpenBSD), etc. 


El development in the case of BSD, it is carried out by groups of hackers (Core Team) and 
others who intend to carry out the complete operating system. Linux, on the other hand, is a 
kernel, not a complete operating system, and it is developed in collaboration with companies, 
hackers, kernel programmers, and other community contributors. Linux definitely has more 
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With respect to licenses, BSD is a proprietary license for the BSD operating systems. This 
license is very non-restrictive, since it allows derivatives or forks to have any type of license, 
that is why there may be commercial and closed BSDs, an example the Apple Mac OS X 
(EULA licensed and paid). On the contrary, GPL is the license that Linux is under and this is 
more restrictive, not allowing derivatives to be closed. So we will never see a Linux that is 
not free. 


La stability and robustness it's pretty good in both cases, both on Linux and BSD. But if 
one should be highlighted above the other, that would be Linux. BSD has stability problems 
when working with some modern programs. Being monolithic kernels, the drivers affect the 
stability of the kernel if a problem occurs. BSD has problems unplugging a USB without first 
unmounting it, generating a Kernel Panic. Linux, on the other hand, is more modular and 
allows you to remove or add modules more easily without affecting the stability of the kernel 
and without having to reboot. 


El performance is another swampy terrain of which many legends exist. FreeBSD is a high- 
performance BSD that is specially optimized. But is it faster than Linux? It should be 
analyzed carefully, the truth is that many Benchmarks tests carried out by Phoronix have 
revealed that BSD is slower than Linux distributions. One of the reasons for dismantling the 
myth is because BSD is developed on Mac OS X computers that use the Clang compiler, a 
compiler that does not precisely stand out for being one of the best. Linux for its part is 
developed thanks to the GCC compiler and this one can claim to be the best and the one 
that generates the most efficient code. 


Linux is more insurance for contributions such as SELinux and AppArmor, not forgetting the 
extensive community of developers who are constantly checking the code for bugs and 
vulnerabilities and improving it frequently. BSD is not so audited and therefore, although they 
say that in BSD it is easier to detect and correct errors by the hierarchy of the development 
team, it is not entirely true. OpenBSD is the BSD intended for security and therefore the 
most secure, but to what extent... and more knowing that Theo de Raadt, head of the 
OpenBSD and OpenSSH project, agreed to leave back doors so that the FBI could penetrate 
these systems. 


In the section usabilityLinux has reached the masses with Ubuntu and today it is easier to 
use than many BSDs. Both are equipped with graphical interfaces that make everything 
more intuitive, but Linux has advanced further in this regard. In fact, not even PCBSD, 
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GhostBSD or DesktopBSD, clearly oriented towards the home user, have managed to keep 
up with the vast majority of Linux distributions. 


As for the hardware compatibilityLinux supports newer technologies and more hardware 
more quickly. In fact Linux does not have much to envy Windows or Mac OS X. In this field 
BSD is light years away, finding itself in the state in which Linux was a decade ago. Much of 
the problem with the BSD hardware comes from its development, since it is implemented 
using Mac OS X systems, the tests are carried out on these machines by virtualizing the 
system with VMWare. What works in virtualization may not work when testing the system on 
a real machine. 


El available software for Linux it is broader than that available for BSDs, although in 
defense it must be said that Linux software can be installed on BSD by enabling compatibility 
for this purpose. In this field it can win BSD, since it also has projects like Wine and other 
emulators that make the software of other operating systems work. On the other hand, when 
analyzing the video game category, Linux wins by a landslide. There are more and more 
video games for the penguin system, while these are in short supply for BSD. 


NetBSD, the system portable par excellence, it has been ported for more than 56 
architectures or hardware families. Do you think it beats Linux? Well no, Linux has been 
ported to up to a hundred platforms (VAX, AMD64, x86, Itanium, SPARC, Alpha, MIPS, 
AVR32, Blackfin, ARM, ARC, Microblaze, SuperH, s390, PA-RISC, Xtensa, OpenRISC, 
PowerPC, m68k, etc._). 


You can see the comparison BSD vs. Linux plus enlarged and complete at blog 
Architechnology. | hope you liked this comparison and that you know how to appreciate the 
good of the GNU / Linux system, instead of criticizing the other systems without knowing 
what they are talking about. 


More information - Jordan Hubbard One Leaves Apple 


Source - Architecture 


The content of the article adheres to our principles of editorial ethics. To report an error click 
herel. 
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Good information, | did not know that the BSD systems had more "flavors", | only knew 
the FREEBSD and the OPENBSD 


Juan said 
ago / years. 


You say you will be unbiased, but | don't see a comparison where BSD benefits. Just 
being able to run Linux binaries. 

BSD offers us very robust, very stable systems and they are more serious projects than 
Linux. The release generation process is much more strict and controlled (not to mention 
that FreeBSD is a complete operating system and Linux is just the kernel). 

On the other hand, everything is much more organized, the documentation is excellent 
and the man pages extraordinary. 

Regarding the use of both systems, in some cases FreeBSD is better, in others GNU / 
Linux. | have had experiences with heavy traffic where FreeBSD performs better. 
Without a doubt, for a normal user on a desktop PC, GNU / Linux is the best option, due 
to the support it offers regarding hardware and due to the development of distributions 
oriented towards ease of use. But in servers, it is an issue to be analyzed, for example | 
would trust more in an OpenBSD or FreeBSD acting as a firewall, due to the robustness 
in that scenario and because of the firewall itself (it is very personal, but | prefer pf before 
iptables). 

| see Linux development as a group of people who want to cover as much hardware as 
possible, without going too strictly into security issues. On the other hand, the hardware 
supported in the BSD is less, but it is guaranteed that it works very stable in what it 
supports. Perhaps progress is slower, due to the reduced number of developers 
compared to Linux, the support of companies, etc. But | see it much more serious. 
Another very important topic in BSD is the ports tree, it allows us to install software from 
the source code, with the clear advantage of being able to modify it and adapt it to our 
needs. Or compiling with flags that would give us a benefit according to our architecture. 
With regard to licenses, the BSD seems simpler and more logical. Because if we talk 
about freedom, the GPL is forbidding us to modify programs and distribute binaries 
without the source code, while BSD is not. Isn't it a restriction on freedom? With the BSD 
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In conclusion, both are very good systems. It will depend on the scenario in which they 
are going to be used or on the taste and experience of each one to decide which one to 
stay with. 


Reply to Juan 


1. 


Anm said 
ago / years. 


Don't be an idiot Juan. The GPL guarantees that the software remains free. Itis a 
restriction towards an aspect of absolute freedom, to allow it to remain free, not 
absolutely. 

GNU / Linux is audited by many companies. BSD for a few only. 

You have more efficient tools than BSD and its approach to innovation allows you to 
improve technology and participate in a large number of scenarios. 

FreeBSD is only good in very centralized ways. 

And stop being such a jerk, it's more common for BSD fans to attack GNU / Linux. 
Also FreeBSD in Hardware support is way behind in many respects. BSD is only 
relevant in small areas. 


Reply to Anm 


1. 


uname said 
ago 6 years. 


Hello Anm, you seem rude to me because of the way you address other users 
by insulting, and you are also terribly wrong because although the GPL license 
in theory protects freedom with copyleft, in practice Linux is full of binary blobs of 
which the source code not available. And this is not said by me, it is said for 
example by Greg Kroah, one of the main Linux developers, that Linux violates 


Las cookies de este sitio web se usan para personalizar el contenido y los anuncios, ofrecer 


; A Aceptar cookies 
funciones de redes sociales y analizar el trafico. +info E 


https://www.linuxadictos.com/en/comparativa-bsd-vs-linux-toda-la-verdad.html?_gl=1%2Aqkr6jn%2A_ga%2AYWiwLWoxTmxS... 6/32 


11/6/2021 


Battle BSD vs. Linux: a new comparison with the whole truth | Linux Addicts 


http://www.kroah.com/log/linux/ols_2006_keynote.html 


So if you don't use linux-libre or the kernel that Debian provides by default, your 
kernel is far from free and | hope you don't use the adobe flash plugin, because 
that isn't free either, or the Skype client, Spotify etc. 


Most Linux users hate Microsoft. Do you know that Microsoft is one of the 
companies that contributes the most to the Kernel? Like many other companies 
of dubious ethics. There you have it, everything is very social. 


And then that other thing that you say that the BSD world does not innovate, 
have you used SSH? It was developed by the people of OpenBSD, protocols like 
TCP / IP and DNS the mainstays of the Internet has a great influence from the 
Unix and BSD world, when it was discovered that open SSL seemed like a 
Gruyer's cheese from the number of holes the first to work in a Reliable 
implementation were the OpenBSD folks with LibreSSL. ZFS Do you know what 
itis? the first to make a port were the people from FreeBSD, do you know what 
pkgsrc is, one of the most advanced package systems? Do you know 
DranonflyBSD one of the most advanced operating systems? And the cages in 
FreeBSD that until then very few companies had done something similar. And so 
on for a long etc. 


And then you allow yourself to call BSD users fanatics ... but please, if you are 
ignorant on a matter at least don't air it with that arrogance, you fanatic. 


Finally, comment that this is signed by a GNU / Linux user who prefers the GPL 
license for its social aspect, but | recognize that the BSD people do things very 
well while Linux is increasingly a kernel poison full of patches and Binary blobs 


that each company puts to support their products. 
Reply to uname 


1. 


Noobsaibot73 said 
ago 2 years. 


Las cookies de este sitio web se usan para personalizar el contenido y los anuncios, ofrecer ki 
: : : Zo h Aceptar cookies 
funciones de redes sociales y analizar el trafico. +info 


https://www.linuxadictos.com/en/comparativa-bsd-vs-linux-toda-la-verdad.html?_gl=1%2Aqkr6jn%2A_ga%2AYWiwLWoxTmxS... 7/32 


11/6/2021 Battle BSD vs. Linux: a new comparison with the whole truth | Linux Addicts 
1) Anm is rude, to disagree is logical and normal, it generates debate and is 
a good thing, not to insult. 
2) BSD is not a bad operating system, regardless of who it weighs, what 
happens is that for some things it is better than Linux and for others not, 
taking that into account, your tastes and needs, you can use one or the other 
and also something better, to use both, complementing each other. 
3) It is not exactly that it contributes to the kernel, it is that they have seen 
the potential of Linux (that which before they did not allow access from a 
Windows partition) and now (which weather vane), to pay it has been said, 
to be able to use it (the kernel ). How? Well, if you look at more and more 
Linux distributions, you have Windows applications, such as Skype, or 
access to Office applications ... Yes, Linux carries more and more 
proprietary software (Nvidia and third-party drivers, Chrome, Dropbox, 
Steam , the Flash Player plugin, Teamviewer, Opera, Spotify, Crossover, 
Vivaldi, WPS and many more that left me in the pipeline). And it also has 
Spyware (if Microsoft recognized that Skype is spying on you, you can 
Google it and see it for yourself). 
4) But it doesn't stop there, not only does Microsoft do it, Canonical does it 
too. Some will remember a guy who said Ubuntu telemetry to you, they sent 
him a legal note from Canonical, ordering him to stop using the term Ubuntu 
and its logo (so he couldn't talk about it). 
Ubuntu and its official derivatives (Xubuntu, Lubuntu ...) not only carry a lot 
of proprietary software inside, they spy on everything you do. That guy, on 
his blog, told how to deactivate all that telemetry / spyware so that they do 
not play with your privacy ... 
5) BSD is better than Linux in some ways and worse in others, but that 
doesn't make it a bad OS at all. 
6) On the subject of proprietary software and spyware, unfortunately, Linux, 
in many distributions, is no longer free, and has spyware, congratulations, 
one more step to look like Windows. BSD in that sense is still free and 
without that spyware called skype. 
7) We should be concerned about what Microsoft is doing with Linux ... Linux 
distributions that are 100% free are becoming less and less. 


Ranlv ta Nanhesaihat73 
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vacagnu said 
ago 6 years. 


It's true BSD can be very good as a firewall, but when you want more advanced 
options like balancing QOS data, or setting up a Radius server, that doesn't exist in 
BSD. It is very limited in terms of options in Linux there are thousands of kernel 
modules to manage a server when you want to start doing things a little more 
advanced BSD falls short. After that of the ports tree ... for that there is Gentoo and 
even Arch with its Arch Build System. 


Reply to vacagnu 


adhoj said 
ago 4 years. 


it is a lie that Microsoft is the one that contributes the most to the kernel. Once 
you correct that approach, you will advance something. 


Reply to adhoj 


Juan said 
ago / years. 


With all the truth? Please.... Linux more secure than BSD? More efficient? Mother... 


Reply to juan 


satartic said 


ann 7 viaare 
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You should document yourself better. Theo never agreed to leave back doors on 
OpenBSD. Moreover, Darpa stopped donating for criticizing the international politics of 
the United States. Further the OpenBSD code was audited and there are no back doors, 
and it was done to prove a false accusation. 


Reply to satartic 


Juan said 
ago / years. 


What a fair comparison (?), | only see comments in favor of Linux and blah blah blah. I'm 
a linux user but I've always liked * BSD. 

That BSD is like linux 10 years ago? What a big piece of shit you have to read with this 
pseudo internet experts. Almost always the new technologies are in BSD and Linux with 
at most 3 months of difference (for example the TRIM command, AHCI, IPv6 and many 
others) 

Anyway, | think the GNU jihadists are annoyed that BSD doesn't use the GPL licenses, 
uses its gcc compiler and calls itself free software and all that verbiage. 


Reply to juan 


moltisanti said 
ago / years. 


Anyway, | just discovered that there is only someone more Taliban than a linux fanboy: a 
BSD fanboy !!! 


Reply to moltisanti 


ja said 
ago / years. 


Yeah yeah 
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Reply to ja 


1a 


The ignorant said 
ago / years. 


Has this boy ever used kldload? he he! poor ignorant ... | do not know how they let 
him publish garbage like this, find out more before comparing ... 


Reply to The Ignorant 


Yo said 
ago 6 years. 


The most ridiculous and not very serious comparison that | saw in my life really worthy of 
an IGNORANT who loves Linux, the fact that several of us use Linux does not mean that 
we despise BSD leaders in performance and security among other things, this blog 
should compare not denigrate, How ridiculous. 





Reply to me 


José said 
ago 6 years. 


In my attempt to get closer to Linux - wanting to leave Windows - | have found more 
tendency to fanaticism than to technology. There are few blogs where comparisons 
between other OSs are approached in an impartial way, not to mention between the 
distros of the same Linux! BSD catches my attention (although | have not used it) and | 
think that even if it was a lousy operating system there would be no reason to insult its 
users. 


Reply to Jose 
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11. 


12. 


13. 
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abrkof said 
ago 6 years. 


documenting yourself more is what you should do before publishing just bogs! .. an 
operating system is never better because it is used by a certain number of users, if not 
for the contributions and solutions that provide the user, in any way, a user of Mac could 
say that Mac is better than Windows or Linux or BSD, in almost everything computer 
fanaticism blinds the opening to new technologies or reengineering to systems that as 
far as we understand it is the system that adapts to the user and not vice versa. 


Reply to abrkof 


César Augusto Balcazar De los Santos said 
ago 6 years. 


But for performance he is very right, even if many are invented here for their fanaticism 
that bsd is more profitable. The benchmarks prove it, the better it is sooken with tests. 


Reply to César Augusto Balcazar De los Santos 


Juan Torres said 
ago 6 years. 


The Linux kernel is not as modular compared to the BSD ... 


Also, | didn't see anything about the benefits of BSD. | use Linux systems, but | was 
interested in testing FreeBSD. And it is a pity that the link sent at the end of the article is 
not available. 


Reply to Juan Torres 
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ago 6 years. 
If you want "the whole truth", here is it (coming from someone who has used both): 


If you require a server without too many complications or a stable and complete 
programming environment and you do not care about the limitations of the GPL license, 
then choose Linux. 


If you require all of the above, and you prefer the BSD license which is basically so free 
that you can even close the code, work on it and sell it (as Apple did with Mac OS, or 
Sony with PS3 and PS4), then choose BSD . 


Performance wise, it doesn't matter! Don't be teased. If Google uses Linux and NASA 
uses BSD it is not so much for performance but for purely technical reasons, in fact most 
laboratory scientists use ... Windows! If you have a not very old computer (and it came 
with Windows pre-installed) both Linux and BSD will run without difficulty (I have an old 
computer from 2006 with 1GB of RAM that | use to experiment and it runs the most 
recent versions of both without problems). 


And if you are a normal guy who is not interested in any of the above and for some 
reason Windows does not suit you, then choose Linux, which is something like a Unix for 
beginners with some "ornaments" (GNOME, KDE, UNITY, etc.), and leave BSD to the 
more advanced users. 


With all of the above, both Linux and BSD have many problems (driver incompatibility, 
bugs, etc.), and you can have very bitter moments (I don't think it is necessary to 
mention them all, you know what I'm talking about). Sometimes a simple update can 
throw the system at you and | don't care what the fans have to say: if you haven't said 
"This sucks!" on more than one occasion when using either Linux or BSD, then you 
haven't used them enough. 


Reply to Uncle with a beard to the waist 
14. 


Polvoron said 
ago 6 years. 
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FreeBSD: for a common suspect like no: the complexities of the installation, the 
advanced knowledge in UNIX and the bugs, more constant than usual that often lead 
you to rewrite almost all the configuration files, throw you back. Now, if you are going to 
use it to manage a network, then yes, because pf is not iptables, and because it is faster 
in conjunction with Apache and Mariadb... .and up to here | fish. 


Linux: we should start with: which of them? You cannot generalize and encompass in the 
word linux toooodo the chromatic fan of distributions, put them in a funnel and say: 
Guindous fortin !. Linux is heterogeneous and outgoing. Linux is the paella. FreeBSD is 
white rice. But leaving the metaphors because I'm getting hungry and the fridge is empty, 
the last time | looked at the broccoli it had mutated and was giving the choped pork 
firewood. Step with my experiences: 


-Ubuntu: | started with 6.04. Many problems. A lot of. A headache. But | endured and 
came 10.04 and then 12.04, although | had to leave it there because the HDD exploded, 
and they installed windows 8 on the new 64-bit computer. But | did not reinstall it. 
Configurable. For an average user it's great. Also, you can do a lot of things with it, but 
then when | went to download 14.04, | heard that a derivative was embroidering it ... 
-Linux Mint: | have tried the distro based on Ubuntu 14.04 and... it consumes less 
resources, you can do the same as Ubuntu and it is fine. For both, the fact that: they can 
be used as servers, although more imprecise than FreeBSD, you can configure them for 
hacking, pentesting, graphic design, games, multimedia, programming: NetBeans, QT 
Creator (community), Gambas, etc ..., and all the libraries you are looking for for Ruby, 
Python, C ++, VBasic, Borland, Pascal, Java ... Highly configurable in every way, not 
only the appearance that FreeBSD users point out as silly, when what it does is facilitate 
the use, but everything. 

For server: FreeBSD, ArchLinux, Red Hat and derivatives of all of them, and Suse. 

For users, of whatever level: ALL, although | would not recommend FreeBSD, 
ArchLinux, Gentoo to those who come from Windows without first going through more 
"home" distros such as Chromixium, Zorin or Chaletos. 


Reply to Polvorén 


1. 
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ago 6 years. 
Rolling releases are not used on a server ... manco 


Reply to Mariano 


Eduardo Inda said 
ago 4 years. 


Hehehe, whoops 


Reply to Eduardo Inda 


Forocochino said 
ago 2 years. 


Just reading the title of this summary of the previous entry in techrepublic told 
me that | shouldn't waste my time. 


Congratulations. Your trollsensacionalista article has gotten one more entry. Also 
a domain-wide blacklist, though. 


I'm going to post to taringa for a while and read the news from Forocoches. 
bye.? 


Reply to Forocochino 


15. 


joan said 
ago 6 years. 
| do not agree with most of the things that this article comments. Apart from saying 


Las cookies de este sitio web se usan para personalizar el contenido y los anuncios, ofrecer 


; af Aceptar cookies 
funciones de redes sociales y analizar el trafico. +info P 


https://www.linuxadictos.com/en/comparativa-bsd-vs-linux-toda-la-verdad.html?_gl=1%2Aqkr6jn%2A_ga%2AYWiwLWoxtTmx... 15/32 


11/6/2021 Battle BSD vs. Linux: a new comparison with the whole truth | Linux Addicts 


Linux is more secure, etc .. it does not delve into both operating systems equally (well, 
Linux is just a Kernel , the system would be GNU). 


What the "linuxers" do not think (for the record that | have been using Debian GNU / 
Linux on my laptop for more than 10 years) is that if you remove the proprietary drivers, 
proprietary libraries and proprietary software from Linux , Linux would not have as much 
hardware support and as much game and as many applications as the article claims to 
have. 

In FreeBSD or OpenBSD we only want to have 100% free software and 100% free 
drivers, to have a safe, reliable, robust operating system but, above all, that gives users 
the freedom to modify and distribute it freely, and that no application of third parties spy 
on them. 


This is the difference today, that the average "linuxero" just wants to have a chupiguay 
desktop with many applications, and they are forgetting the origin of why Linux was 
created, and specifically, why Richard Stallman created GNU. 


With BSD we keep that spirit. In addition to, of course, having the normal desktops 
(Gnome3, KDE4, xfce, and all the above), programming applications (Geany, Emacs, 
etc.) and services for hosting, security, analysis, etc. 


In conclusion, if you take away everything proprietary from GNU / Linux (non-free, in 
debian) it might look much more like any computer with BSD installed. 


Greetings to all. Long live Free Software and long live Anarchism. 
Reply to joan 


a 


uname said 
ago 6 years. 


Joan, completely agree with everything you say and Long live Anarchy! 


One issue, Joan, in your opinion do you think it is more socially responsible, a Linux- 


hased distro licensed with a verv social annroach like the GPI hut that has actually 
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http://www.linuxfoundation.org/about/members 


In addition to the blobs, binaries, firmwares, and bots | talked about in response to 
Anm's comment. 


Or the BSD operating systems are more socially responsible, with a more careful 
development, led by hacker communities, without large corporations roaming around 
at ease, but with a license that, although it does not reduce freedom to users, does 
not preserve it either. 


The ideal thing for me would be something like GNU / BSD but it will be that there is 
not much feeling! XDDD 


Reply to uname 


16. 


George said 
ago 6 years. 


Good comments overall. But | see some a little risque using unfriendly and unnecessary 
terms. Let's not forget that we are on the web and everyone reads us. 


Reply to Jorge 
17. 


elvis said 
ago 6 years. 


The opinions are only opinions. Being dismissed without showing concrete data is easy 


Reply _to elvis 
18. 


uracil said 
ago 6 years. 
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20. 
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Joan. Without going into disqualifications because we are here to discuss amicably, | 
think you have excelled with the final part of your comment. 

Like you, | also use linux. It seems like an OS to me, just magnificent. 

| humbly believe that your reference to the need for non-free may be due to your specific 
hardware configuration. 

In my case, my entire system works wonderfully including the video card, (even if | install 
the proprietary NVIDIA drivers through its control panel). 

For the rest | use applications of all kinds and | have not had to use any additional non- 
free repository apart from the ones that Debian provides by default. 

A greeting. 


Respond to uracil 


Antonio said 
ago 6 years. 


Sorry to revive a post from 2014, but as a free software user | would like to comment. 


| use GNU / Linux in a more personal environment. Of 2 computers | have one with only 
GNU / Linux and the other a dualboot with GNU / Linux and Windows (unfortunately | 
need some programs that, the less they work better in Windows). But in my work | have 
a FreeBSD server mounted, and previously it was on GNU / Linux. 


| think that GNU / Linux, although it is also robust for work environments, looks more for 
desktop environments, and BSD as a server is wonderful 


Reply to Antonio 


gavilandelbosque said 
ago 6 years. 


| have left the University of California. That is to say, my first 40 years | was in California 
during the development years of IBM-PC, Microsoft, Apple, Google, Silicon Valley, etc. | 
am not an expert in informatics (biology), but | have developed computers all my life to 
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more words: License is everything. If you are going to need a system that you have full 
control over, choose BSD. Linux and GNU is not really free - it is like saying that the 
People's Party is popular. If you are used to paying for Windows and have a little 
technical ability and want to replace your money with labor and eating your coconut, 
choose Linux. Choose the distribution that works best on your computer - you have to 
spend weeks and try. 

If you are a professional whose purpose is to develop internet programs for companies 
and maybe you want to match them with the operating system (and associated 
programs), choose FreeBSD. If you are only going to develop common internet 
programs (CMS, etc.), choose Redhat / Fedora. But, in both cases, in the end, you are 
going to learn all the systems, Java, 

Apache, Tomcat, Postgres, Whitebeam, node, Clang, etc., etc. Then you can specialize, 
if it matters. There are also Android emulators on Linux too, right? A great Android 
tablet perhaps better and you can forget the past, illusions of freedom, your wishes and 
swallow everything that Google decides, if not GNU, the Windows clan, or international 
agreements (Berne). Freedom is not a small home. (Excuse my Spanglish, please.) 


Sebastian Marchionni said 
ago 6 years. 


Hello. | am a Linux user. | tell you my experience for whoever can serve you. 


| am not going to compare with FreeBSD because | did not use it, but it is obvious that in 
many things Linux will win and in many things Linux will lose, according to the user's 
need. 


In terms of performance, all Linux cannot be included as if they were the same. | was 
testing many distributions until finally | got Debian, which had everything | wanted and 
needed. Until systemd came along and | tried Slakware and Devuan. Despite having 
gone through many distros, | was shocked when | tried Slackware, the difference in 
speed and fluidity compared to Debian was total, it was like making a leap into the 
future. Among the other distros that | had never tried the difference had been so 


ramarkahla 
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Linux mint: Possibly the easiest operating system to use for the regular desktop user. 
Many will say no, but usually they say it because they are already used to Linux and 
derivatives and they are all equally easy. | tried it with my old men who are about 70 
years old and have no computer skills and adapted faster with windows (both xp and 7). 
| work as a technician so | had clients test it and the result was the same. For those who 
do not understand anything at all, it is the easiest thing there is. In itself the installation is 
simpler than setting a clock. Put the live cd and there is a shortcut that says "install linux 
mint" double click, put the country, the language, wait a few minutes and restart. 


Devuan: he did not answer me like Debian, it is in the testing phase and it shows, also 
as they clarified me, they are focusing first on making it work as a server. For a common 
user it is not ideal. 


Debian and free software: | always used all free software except video drivers, no matter 
how fanatic one is, it ends up falling for private drivers or accepting free ones sacrificing 
video card performance. 


On the licenses: To say that the BSDs are freer because they allow you to close the 
code and so on, is an individualistic and short-term vision. GNU ensures freedom of 
technological development, while BSD ensures freedom of technological use by the 
individual. Now in practice, as they say it is the same, it is full of linux programs that do 
not comply with GNU. More importantly complying with GNU you can implement 
something like systemd, you could also with BSD; My point is that someone mean would 
always find a way. 


In terms of security, linux has specific distributions for this purpose, like FreeBSD and 
also to break it, like Kali. 


My conclusion is this: These discussions and comparisons are trivial. Regarding security, 
performance, possibility of modifying etc ... very advanced knowledge is required to be 
decisive. The few people who can feel and be affected by these differences are likely to 
be those already working in both the Linux and FreeBSD development groups, not 
writing and testing distributions or working in some small company managing servers. 


As an additional fact and due to my work, | get tired of seeing people obsessed with 
performance. They pay a lot for state-of-the-art hardware which they then pack into a 
noorlv halanced nc Thev are lookina for software that is canahle af resnandina to 
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easier than correcting the error, doing it right again from scratch), using applications so 
that the pc manages resources better but at the same time consuming them for using so 
many of those apps. | also work as an expert and advisor on these issues with a law 
firm, and ALL that "security" that they so much presume is solved in a simple way, 
violating people not machines (as Kevin Mitnick did at the time) . The following paradox 
arises, all those detailed and specific questions, without awareness and commitment to 
whatever it does, are of no use and if you have that level of awareness, order and 
professionalism, they end up being unnecessary. 


I'm going to try FreeBSD and possibly after a while | will stop it and it won't work for me, 
not because it's bad but because from what | see it won't respond to what | need, in the 
same way as hundreds of Linux distros and all windows. For another FreeBSD it may be 
just what you need. Someone else can use a particular Linux but you learned to use 
FreeBSD and you find it comfortable and you know it and it is definitely a working tool: 
the same can happen to a Linux user. 


From using FreeBSD | will have the knowledge. People who develop BSD or Linux, 
cannot be at all, they choose one and continue to develop it, in the same way that we 
choose one and continue to use it to work, with the difference that we can change all the 
time while they do not and for That is why we end up fanatically discussing these issues, 
when the only ones who have a true right to speak fanatically are those who every day 
when they get up go to work to make these systems that we talk about so much 
possible. 


PS: Both the note and the comments regardless of putting BSD at a disadvantage 
further encourage me to use it because | could never find an unbiased analysis on the 
subject, both done by BDS and Linux people and the only option is to use it myself . 


Reply to Sebastian Marchionni 


1. 


Isaac PE said 
ago 6 years. 
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You have criticized my article alleging a series of personal considerations of yours. | 
could make myself interesting and tell you that you are not right or refute you, but 
when | wrote this article perhaps | was thinking other things different from what | now 
believe with a little more experience. Therefore, | can only honestly say that you are 
absolutely right. Amen! 


Thanks for reading us. All the best. 
Reply to Isaac PE 


22. 


Sebastian Marchionni said 
ago 6 years. 


Don't criticize your article. As much the comments but neither. But the fact that you are 
always "competing" for the performance of a tool instead of thinking about what it is for 
and who is going to use it. To give an example, surely most of us here hate windows, but 
for a bank or someone who works in offices (in Argentina, my country) that is the only 
system they will use, on top of XP, and the only one that learning is going to help you. 
Also, you will not need to learn it in depth, just the very, very basic. With Linux the same 
thing happens thousands of Linux, all for different things. Debian served me, partly 
because of its ease of use and stability, of course | came to it for an ideological issue, | 
estimate that many other distros would serve me, but | came to Debian and it responded 
to everything | needed. 


Now, | spent a while with Devuan, which has problems that | can't solve, so | switched to 
Slackware. What | use it for, both are good and what they are different about | don't have 
as much knowledge as to take advantage of it, which is what happens to most Linux 
users; that it is difficult to use is a myth; More than a myth, it is a thing of the past, today 
they are all easy to use for a standard user. When a problem arises it is something else, 
in my case for example | systematically run out of server x every time | update and 
without the network administrator. In terms of performance, if you compile sources 
regardless of the distro, the speed is noticeable. 


My point is this, most are exquisitely picky about a system without being exquisitely wise 


| a | a aren eee meet 
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With the arrival of systemd, what we liked so much about Linux is completely lost and 
everything is unified, like a kind of small variants of windows with their frameworks. Few 
distros don't use it, some of the ones that don't already said they were going to 
implement it. The possibilities are then reduced and the idea of FreeBSD begins to 
become more attractive. Of FreeBSD it is always criticized that it does not have a great 
variety of drivers and therefore performs less. Really only in games could this difference 
in speed be significant, for which directx is always higher on windows anyway. Maybe 
someone who needs to do big video renders, or big lab calculations, but the latter two 
are going to have to use what their companies tell them to use, not what performs best. | 
have as an example my best friend who works in the defense ministry and where one 
expects sophistication and a meticulous choice of the tools to use, it is solved trivially by 
questions of contracts with companies, budget etc ... that is, money decides and not 
intellect . 


It is true what you say about the staunch defenders of FreeBSD, | have read them, but it 
is exactly the same with Linux and Windows (Mac does not deserve to be mentioned). It 
is almost impossible not to be impartial because there is an important underlying issue 
that divides, which has to do with the role we give to information, knowledge and 
technological development. Ultimately what tends to ignite our passions tends to have 
more to do with that than with actual performance. | also say it as someone who loves 
Linux but also games and when it comes to playing opengl! and wine they have a totally 
inferior performance, of course there are games that the PC is so abundant that it does 
not matter, but for the newer ones it is. 


PS: from my point of view systemd is the destruction of Linux as we know it and we 
would have to focus on learning and especially promoting the distros that do not use it 
and even support different options such as BSD in order not to appear "new windows 
with another Name". 


Reply to Sebastian Marchionni 


Sebastian Marchionni said 
ago 6 years. 


Rv the waw fram the heninnina | made it clear that thev were mv nerennal 
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Reply to Sebastian Marchionni 
24. 


David said 
ago 5 years. 


| am a software engineer in a company oriented to the development of security software, 
specifically | work with compiler theory, and I'm sorry Isaac, your argument is more than 
poor comparing GCC with CLang (front of LLVM), | don't know if you have stopped 
sometime in understanding the architecture of one compiler and the other but despite the 
fact that GCC does its job it is like comparing a 600 against a Ferrari, | am not going to 
discuss differences, you can see them in http://clang.llvm.org/comparison.html#gcclf 
Linux uses GCC, it is because the kernel code is very tightly coupled to GCC-specific 
options. 


| also consider myself a "decent" programmer in both Linux and BSD kernel space, as 
well as user space, and | do just as well on Linux as FreeBSD. 


Regarding security, it is true that SELinux may seem interesting, but in my vast 
experience | have not seen anyone who uses it properly, despite the fact that Red Hat 
installs it by default on their systems and on Fedora. Even so, | can admit that Linux can 
have certain security advantages, yes, in terms of accouting Linux it relies on CGroups 
that seem to me to be a complex and unfortunate system compared to the FreeBSD 
audit trails, the kernel namespaces (what what people know as containers in user space) 
are a crude imitation of BSD jails and with many shortcomings (see the / proc issue 
within containers). 


Unfortunately neither Linux nor BSD can claim to be microkernel, their architecture is 
based on running linked modules and to be honest | have seen linux burst with kernel 
panics more times than BSDs. 


The performance? Well, it depends, Linux has many companies behind it and many 
drivers are very prepared, the case of the e1000e (intel network card) comes to mind, it 
may be that in specific cases of this BSD style it has a disadvantage, But we must not 
forget that many manufacturers base their network hardware on BSDs (switches, 
routers) with specific hardware and that is when the poor Linux are humiliated. 
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Linux is a bloody mess, / sys, / proc, ioctls (and I'm not just referring to terminals or block 
/ character devices), opening NETLINK type sockets, sysctls ... All this to communicate 
with a kernel, in FreeBSD you | will summarize it: sysctl, period. 


And | am not going to elaborate much more, that comparisons are hateful, everyone 
looking for info: 


ZFS vs btrfs 

PF vs iptables, or if you want, netfilter 

FS hierarchy in FreeBSD vs Linux, and tell me what is / run and / var / run; / media, / 
mnt, and / run / media; / opt and / usr / local and a lot of nonsense. 


And why not go further, the abomination of systemd, the creator of your magnificent 
bonjour demon, avahi daemon. 


Read the FreeBSD (/ usr / src) and Linux code, and then choose what you use 
Reply to David 
25. 
Eubeth Erg said 
ago 5 years. 
klxox nkcnsxgxbx issfsjsh 
Reply to Eubeth Erg 
26. 
Rodrigo Mariano Villar Vespa said 
ago 5 years. 


gnu / linux is better and also has more software 


David glz said 
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Heavens, after reading all these comments | realized that there is a controversy between 
which system is better than another for years ... comparing for example the Mac OS with 
Windows in any of its versions and comparing Windows with Linux, and now | see it with 
Linux and BSD in any of their versions. The truth is that they are all good as they say it 
depends on the type of user and to tell the truth each person will say that the OS they 
use is the best because they are using a single point of comparison or several, the OS 
comparison is even on cell phones ... Thanks to my luck | would say, | have been related 
to many operating systems since Windows 97 which was the first OS | used, then it was 
XP and there | still did not have a point of comparison because it was only an update 
and improvement, then | had the experience From meeting computer science students 
they did not teach me anything: v but | was able to spend time and learn from them, they 
used Debian, that's when | learned that there were more OS and that they were used for 
other things | understood that for a normal user it was Windows and yes You wanted a 
server, you used Linux, why did they practice and set up servers in Linux, it should be 
noted that | was in high school, | did not understand how all this worked very well, | 
began to investigate and read a lot about thehistory of current operating systems and 
their origins, then | met Mac OS and many Linux distros at that time | thought that BSD 
was a Linux: v but now that | have more extensive knowledge about the structure of an 
OS and its kernel, too of the C language, etc, | am a Linux user to this day | use 
Archlinux | started to use it to learn and | liked it, right now | download openBSD, from 
what | see it is very good to be able to use the code in the way you want, also which is 
very stable but that does not mean that | am going to stop using Arch Linux, nor that | 
stop using windows, as for Mac | like it for its ease and simplicity of use in one day you 
learn to operate the equipment, mention the advantages and disadvantages of each one 
does not say if one is better than another, it simply helps a user to choose according to 
their needs, why all OS have different approaches until today there is no perfect one. 


Reply to David glz 


JJSC said 
ago 4 years. 


What a controversy, both are good, stable and serious, Long live everything that has 
heritage from UNIX (other than Microsoft); ) 
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29. 


anon said 
ago 4 years. 


Look, | do not think or refute who wrote this article, or judge him. I'm just going to 
comment on my experiences using both * types * of systems: in case someone who 
stumbles upon this blog and plans to send rm to windows, or even try other systems. 
Linux: use Gentoo. Very good, both graphic and to download and install. A bit fucked up 
to install with commands, but if you are daring or know some syntax, then it is yours. 
Well, I'm still testing it in VirtualBox, so maybe I'll add something else in the future 
because | don't use it much and would like to "test" it a bit more. 

Arch... well, as far as | know, it only comes in x64. Bad point: there was a time when my 
processor was x32 or x86, | do not remember well. Kick and renegade so you can even 
test it in VB; it was all useless. But like Gentoo, a headache if you want to install it with 
commands. Which is why, when you bought such a processor, | didn't think about 
installing it. The commands are almost like in any linux, but like | said, | did not use it, so 
maybe now | will try to test it. 

Linux Mint: great. Very good for users like me, who are looking for something more 
desktop because | am not a hacker, much less to spend hours typing commands and 
modifying files so that the system does a mediocre basic task. | remember that | had a 
software center, or something similar, where | could download programs that they 
suggested to me. Good programs, great variety of them, | could install .deb without 
problem. Good performance, it comes in two types of architectures. Good graphical 
appearance (with the graphical environment by default). | would say that it is 
recommended for those who are not looking for something complicated. | believe it, but 
since today they throw you away for giving your opinion ... anyway, | don't give a damn 
what they might criticize me, that's why | leave it. 

Ubuntu:... some problems, | think | remember. The main reason | stopped using it was 
because | read about backdoors, | don't know if it is here or elsewhere. | should check it 
out for myself. 

Debian: great. Although if you don't like dealing with commands, better use Ubuntu, 
Linux Mint, or go back to Windows. Wide variety of programs. Great ease of use for the 
user. It comes in various architectures. Very stable, wit if you cut the ' peed 
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now that | try to install it in VB (I have a suspicion; keep reading and you will see why | 
think the installation fails). 
Red Hat: in my life | could use another version that was not the one from the first years. | 
think it's from when it was called Red Hat, now | think it's called RHEL (Red Hat 
Enterprise Linux). | will not give my personal data to a company that does not even let 
me test the system to see how it is. 
Solaris: same as Red Hat. Although | tried to download OpenSolaris, but it was more of 
the same. 
Oracle: never use it, you should. Or at least try it. 
Mandriva: | didn't use it either, | don't know much. 
openSUSE: neither, | never tried it. | don't know if I'm going to do it. 
Previous: | liked it when | heard that it was not necessary to download "releases" or 
anything like that: a single version or something like that, but | thought about that and 
decided to use another OS. 
Manjaro: | think | used it once. | do not remember much. 
Well, those are the ones | remember from Linux. Now we go to the fat, to the hard and 
heavy: BSD-UnixLike. 
HardenedBSD: complete garbage. | hardly managed, after more than two weeks of 
struggling (because | already said that | am not a programmer or hacker or one of these 
geniuses) to install even the basics. It only comes in x64. It doesn't use "pkg" like FBSD, 
it uses "pkg-static", which | have barely read about (nor do | know if FreeBSD knows 
much about it), but as far as | could use it, it worked like traditional pkg. Unfortunately, 
after getting its package installer to work, | couldn't even install pkg, because it was 
telling me there was a missing library or something like that. In the FBSD forum they just 
wanted to tell me about it, because it was another OS, but they told me to try reinstalling 
it; that maybe it was the upgrade that did not complete well. | do not know. Bad mouth 
taste. 
FreeBSD: bad and good. Love and hate. Problems and solutions, although sometimes | 
didn't even find those. | have a DVD player and so far | can't get it to work on this 
system. It uses the UFS format, according to what | know. A type of format even more 
exotic and unknown than the ones | saw in Linux. Unmountable format in all linux that | 
have tried, although it was not in many. Difficult, sometimes impossible, to handle certain 
things. And forget about using old versions: | have read about users who still use 
versions prior to 10. | did not know anything about that and tried to install 10.2 to my pc, 
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Of course, do not think about using 11.0: | read a user who stopped working a couple of 
things or the entire system, | do not remember well. If you are a hacker, you are a 
computer scientist, you are given these manias, or you just want to fight like me to even 
see how it is for yourself, install it. It has the ports, which sometimes crash and 
sometimes don't. You have pkg, which is not bad, but hopefully they will not change it 
again soon as it was with "pkg_add" or "pkg_delete" | think, which is now "pkg" and 
whatever you want to do. You can strengthen the system, you have tools for that, 
according to Lei. You can do without the graphical environment, almost like in Linux, but 
for me at least, it was a little easier for me to handle as well as in Linux. And | don't know 
what else to tell: it's almost like Linux, just very different. It doesn't use systemd, so if you 
don't like it or hate it, you can use this type of OS, which | think doesn't use it (I think it 
uses systemv; I'm sorry I'm not a hacker and I'm not interested in being corrected with an 
air of superiority, so if I'm wrong and you want to make me see it, try not to be 
pretentious). 
At the moment, apart from windows 7, xp, 98, 95, and the alleged vista garbage and the 
real ultra mrd from win 8 and 8.1... those were the ones | used. Way above, so if you 
intend to come to attack me with computer science or hacker arguments, | am already 
letting you know that | do not intend to answer you. First because | do not comment here 
for that. The other is because I'm not going to talk about what | don't know. And finally, 
because even if you know, if you are pretentious and give yourself superior for using this 
or that (like all good fans), first try to get out of your usual system and try to use 
something that does not bite. 


Reply to anon 
30. 


XxXxX said 
ago 2 years. 


Pretend that a page called LinuxAdictos is impartial. 
shortly the only good thing about bsd is that you can run / emulate linux. WoW this 
comparison is funny. 


Reply to XxXxX 
31. 
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ago 1 year 


As long as bsd has 32-bit support, it doesn't matter, linux stopped being at the moment 
of not using 32-bit. bits does not have, despite being as they say obsolete, | am working 
on enhancing the 64-bit system and improving the drivers that they are taking out of 
circulation 


Reply to esteban tam 
32. 


Andros said 
ago 1 year 


| do not feel impartial in the article, BSD details such as the robustness of ZFS, the Linux 
emulator, the documentation in the FreeBSD Handbook or the fantastic Ports that was 
long before AUR in Archlinux are missing. Other websites like 
https://programadorwebvalencia.com/bsd-vs-linux-en-escritorio/ , or the official 
documentation https://www.freebsd.org/doc/es/articles/explaining-bsd/comparing-bsd- 
and-linux.html They give an extra piece of information that is important not to ignore. 





Reply to Andros 
OO: 


Patri said 
ago 7 months 


NomadBSD or GhostBSD are much easier to install than any GNU / Linux, or OpenBSD, 
that their installer is wonderful, and you don't mention it in the article. NomadBSD can 
run on a simple USB with persistence and you have a complete FreeBSD that does not 
need a hard disk, or if you prefer you install it later to the hard disk. 


In addition, the article comments on many lies that | do not know where the author got 
them from, such as that FreeBSD is developed from MacOS X ¢?? 


Nor does he comment on how outdated and tedious the SystemD system is and why 
there are more and more distributions that mimic BSD systems and eliminate SystemD 
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The article also does not mention that there are more developers active in BSD and 
events such as Hackathons than the chupiguay community of users who change 
wallpapers, themes and icons in Linux distributions that all they do is imitate Windows, 
instead of worrying about having a good code, useful and up-to-date documentation, and 
putting security at the core of the operating system, like OpenBSD does. 


Reply to Patri 
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Google2Ubuntu, use Google voice commands in Ubuntu 
Rumor or reality: do Bill Gates kids use Linux !? 
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UNITED STATES v 
NEWS ANALYSIS 
Are the BSDs dying? Some security researchers think so 


Too few eyeballs on code is a security issue as vulnerabilities go 
Unreported and unpatched. Can FreeBSD, OpenBSD, and NetBSD survive? 


By J.M. Porup 


Senior Writer, CSO 
JAN 25, 2018 3:00 AM PST 


The open source Berkeley Software Distribution (BSD) versions of UNIX suffer from a lack 
of eyeballs on their code, and that hurts their security, Ilja van Sprundel, director of 
penetration testing at |OActive, told an audience at 34c3 in Leipzig, Germany at the end 
of December. 


[ Learn How to track and secure open source in your enterprise. | Get the latest from CSO by 
signing up for our newsletters. ] 


Struck by the small number of reported BSD kernel vulnerabilities compared to Linux, van 
Sprundel sat down last summer and reviewed BSD source code in his spare time. "How 
come there are only a handful of BSD security kernel bugs advisories released every 
year?" he wanted to know. Is it because the BSDs are so much more secure? Or is it 
because no one is looking? 


van Sprundel says he easily found around 115 kernel bugs across the three BSDs, 
including 30 for FreeBSD, 25 for OpenBSD, and 60 for NetBSD. Many of these bugs he 
called "low-hanging fruit." He promptly reported all the bugs, but six months later, at the 
time of his talk, many remained unpatched. 


"By and large, most security flaws in the Linux kernel don't have a long lifetime. They get 
found pretty fast," van Sprundel says. "On the BSD side, that isn't always true. | found a 
bunch of bugs that have been around a very long time." Many of them have been present 
in code for a decade or more. 


OpenBSD the "clear winner" for security 


OpenBSD's focus on security for the last two decades shows in the code, van Sprundel 
told the audience. "OpenBSD by far has the most knowledgeable developers when it 


comes to security." 


For one thing, OpenBSD has a much smaller code base, around 2.9 million lines of code, 
compared to FreeBSD's roughly 9 million, and NetBSD's 7.3 million. "Obviously this plays 
a part," van Sprundel says. "You can't have a bug in code you don't have." 


This smaller code base is partly by accident, he suggested, in that a lack of developer 
resources has prevented OpenBSD from implementing all the features they want, but also 
smaller on purpose, a deliberate decision to reduce attack surface, including removing 


support for rare, uncommon and older devices and architectures. 


[ Learn how IT can harness the power and promise of 5G in this FREE ClO Roadmap 
Report. Download now! ] 


In terms of code quality, van Sprundel also praised OpenBSD code, noting that "low- 
hanging fruit like integer overflows are as good as gone in most places," and that "the 
most consistent quality was observed with OpenBSD." 


However, OpenBSD's relative lack of popularity hurts the operating system's security, he 
suggested. "Bugs are still easy to find. If there were more people looking at OpenBSD, 
there would be more bugs [reported]." 


Theo De Raadt, the founder of OpenBSD, agreed with van Sprundel that more eyeballs 
on OpenBSD would make the operating system more secure. "| remember reading his 
first slides, which were mostly about the impact of small API misuses," De Raadt tells 
CSO Online by email. "Unfortunately, this is a problem of the volume of code relative to 
manpower. Ensuring all code is 100 percent bug-free and handles all exceptional 
conditions is a rather difficult problem." 


van Sprundel also praised OpenBSD's response to his bug findings, saying that De Raadt 
responded within a week, and OpenBSD patched the flaws within a few days. 


"| communicated with Ilja from the start and got our team working on his discoveries," De 
Raadt writes. "We solved them all within a week or so and made patches available for the 
ones that were important. In my experience the only way to be proactive and responsive 
in a volunteer-driven software project is to never allow deferral of an issue to later. 


Problems must be handled ASAP to keep the interest in them up." 


NetBSD the "clear loser" in terms of code quality 


NetBSD's focus for many years has been to support the widest range of hardware 
possible. With this objective, however, comes the need to include a large quantity of 
legacy and binary compatibility (compat) code of varying degrees of quality, van Sprundel 
pointed out, and as a result "NetBSD seems to be less consistent with security code 
quality." 


The NetBSD response to van Sprundel's bug reports was both strikingly good and bad. 
On the one hand, he says, "They fixed virtually all bugs submitted, pretty much 
overnight!". On the other hand, those patches have yet to be shipped to users six months 
later. "Unless you run your own builds from recently checked-out code, your NetBSD 


machine is still vulnerable." 


NetBSD developers corrected van Sprundel's account, noting that NetBSD 7.1.1, shipped 
on December 22, 2017, (a week before his talk at 34c3) contains patches to the security 
issues he found. "A lot of his findings were in the binary compatibility layers, and these 
aren't things that are going to cause a remote vulnerability anyway," Taylor R Campbell, a 
member of the NetBSD Foundation board of directors, says. "Someone would need 
access to the system anyway to run that code." 


The large number of bugs van Sprundel found in NetBSD, and the project's sluggish 
response, raises red flag about the future of NetBSD. "NetBSD is practically dead," 
Patroklos Argyroudis, a security researcher at Census IT Security Works, whose work on 
BSD security van Sprundel cited in his talk, says. "In the past there were some companies 
that were trying to support it commercially, but | think they are long gone now." 


Although NetBSD is a volunteer-driven open source project without any full-time 
developers, Campbell and David Maxwell, a former member of the NetBSD foundation 
board, are both confident Agryroudis's pessimism is unfounded. "Our primary goal is to 
have a core system with a clean architecture, then it becomes really easy to port to new 
platforms," Maxwell says. "We'll probably continue to be strong in the place we've been 
historically." 


"We are also notoriously bad at marketing," Campbell adds. 


FreeBSD, the "most technically advanced" of the BSDs 


Long heralded for the performance of its network stack, FreeBSD is by far the most 
popular of the three big BSDs and finds a home at Netflix and WhatsApp, among others. 








"In modern perf tests, FreeBSD is on par with Linux or surpassing it a little," van Sprundel 
says. "Any place where you could deploy Linux, it's safe to say you could probably deploy 
FreeBSD. They are massively deployed in lots of places." 


FreeBSD responded to the 30 kernel bugs in about a week and fixed a few in their source 
code repository. However, the software project released only a handful of advisories, and 
"the status of the rest is unknown at the moment," according to van Sprundel. 


The FreeBSD project pushed back on van Sprundel's findings, however. "One of the 
issues we have is there's a large variety of issues that are being found but there are some 
issues that have no practical exploit," Ed Maste, director of project development at the 
FreeBSD Foundation, and member of the elected FreeBSD core team, says. "We've 
started treating some of these as just bugs and not as security issues." 


The lack of developers hurts FreeBSD's security, not only in their ability to respond to bug 
reports, but also to implement new, industry-standard security features, Argyroudis 
suggests. "The most popular BSD, the most technically advanced, is FreeBSD, but they 
don't have as many developers [as Linux], and that basically means they are a bit behind 


in terms of security features." 


Only recently has FreeBSD implemented preliminary support for ASLR in userland, 
Argyroudis says, and does not yet support KASLR. He also questions whether FreeBSD's 
network stack is still a killer feature. 


"Maybe ten years back there was this notion that FreeBSD was better performance wise, 
that its network stack was much better, and other such things," Argyroudis says. "I'm not 
so sure if that's the case anymore. | would definitely be skeptical about that." 


Maste disagrees. "We are able to do a phenomenal amount of work with a much smaller 
developer base, phenomenal both in terms of quantity and quality of work compared to 
Linux," he says. "The suggestion that our future is somehow hampered by a lack of 
developers is absolutely untrue." 


Do FreeBSD kernel vulnerabilities affect OS X? 


There's a lot of FreeBSD code in Mac OS X, and the FreeBSD security team coordinates 
disclosure with Apple, van Sprundel says. It remains unclear, however, how badly these 
reported vulnerabilities affect Apple laptops. The Darwin kernel has diverged sharply from 
the FreeBSD of 15 years ago, and OS X has received a great deal more scrutiny from 


security researchers over the years. 


"When | submitted the bugs | had to the FreeBSD guys, they asked 'Do you mind if we 
send this to the guys at Apple?™ van Sprundel says. "So, the security team at Apple has 
this list of bugs. | have no idea how much of it applies to them. There's probably a couple 
of bugs that apply there." 


Apple did not respond to our request for comment, and Maste declined to speculate, 
pointing out that only Apple would know the answer to that question. NetBSD's Maxwell is 
quick to point out that OS X includes code from not just FreeBSD, but also NetBSD and 
OpenBSD. 


Are the BSDs dying? 


Popularity affects security, it turns out. More eyeballs on code means shorter bug 
lifetimes, and more developers means new security features reach users faster. The 
BSDs have lost the battle for mindshare to Linux, and that may well bode ill for the future 
sustainability of the BSDs as viable, secure operating systems. 


"Say what you will about the people reviewing the Linux kernel code, there are simply 
orders of magnitude more of them," van Sprundel concludes. "Based on my result, code 
quality alone can't account for the discrepancy between the bug numbers (BSD vs. 


Linux)." 


OpenBSD may be the most likely to survive, despite being far less popular than FreeBSD 
at the moment, Argyroudis suggests. "I see a greater chance for OpenBSD to survive 
because it has a more focused use case, and targets specific things. FreeBSD, | think it's 
much more difficult for it to survive than OpenBSD." 


Measuring the popularity of the BSDs is difficult, however, Maste argues. "One of the 
challenges with trying to measure or quantify the popularity of FreeBSD or the other BSDs 
is that in a lot of cases it's used in applications or deployments that are not particularly 
visible," he says, such as appliances or products that build on derivatives of FreeBSD. 


The permissive BSD license makes it even harder to quantify the popularity of the BSDs. 
"For end users, things like the license on the code may not matter much," NetBSD's 
Maxwell says, "but for the people who build embedded systems, for the people who are 
building products, the licensing of the code is very important." 


Argyroudis remains pessimistic about the future of the BSDs. "I love the BSD code base, 
he says, "and | would love to be able to tell you different things, like how much more 
popular FreeBSD is and how easy it is going to be to survive against Linux. But 
unfortunately | don't think that's the case." 


"| think it boils down to a lack of developers." 


More on open source security: 


e 5 open source security tools too good to ignore 

e Open source software security challenges persist, but the risk can be managed 
¢ What is the Heartbleed bug, how does it work and how was it fixed? 

e What do open source maintainers know about security? 


e Is 'secure open source component use’ an oxymoron? 
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